Lucene search
+L

6935 matches found

CVE
CVE
added 2025/12/02 4:37 a.m.34 views

CVE-2025-13387

CVE-2025-13387 affects Kadence WooCommerce Email Designer for WordPress. The WordPress plugin is vulnerable to unauthenticated stored cross-site scripting via the customer name in all versions up to 1.5.17 due to insufficient input sanitization and output escaping. Several connected sources confi...

7.2CVSS4.9AI score0.00298EPSS
SaveExploits0References2
EUVD
EUVD
added 2025/12/02 4:37 a.m.15 views

EUVD-2025-200181

The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

7.2CVSS4.8AI score0.00298EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2025/12/02 4:37 a.m.35 views

CVE-2025-13387 Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting

The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

7.2CVSS0.00298EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2025/12/02 12:00 a.m.23 views

PT-2025-48640

The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

7.2CVSS5.2AI score0.00298EPSS
SaveExploits0References3
EUVD
EUVD
added 2025/11/30 3:30 p.m.14 views

EUVD-2025-199930

A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public a...

7.5CVSS7.2AI score0.00401EPSS
SaveExploits1References5
CVE
CVE
added 2025/11/27 11:04 a.m.51 views

CVE-2025-13742

CVE-2025-13742 affects pretix and describes a vulnerability in email template rendering where placeholders (e.g., {name}) can cause user-provided content to appear in emails with HTML/Markdown formatting. Although pretix uses a strict allow-list of HTML tags that prevents XSS, this can be exploit...

6.1CVSS5.7AI score0.00183EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2025/11/27 9:54 a.m.12 views

WordPress Customer Reviews Collector for WooCommerce plugin <= 4.6.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Customer Reviews Collector for WooCommerce versions = 4.6.1...

6.1CVSS6.3AI score0.00205EPSS
SaveExploits0References1Affected Software1
The Hacker News
The Hacker News
added 2025/11/27 7:03 a.m.9 views

Gainsight Expands Impacted Customer List Following Salesforce Security Alert

Gainsight has disclosed that the recent suspicious activity targeting its applications has affected more customers than previously thought. The company said Salesforce initially provided a list of 3 impacted customers and that it has "expanded to a larger list" as of November 21, 2025. It did not...

6.5AI score
SaveExploits0
Cvelist
Cvelist
added 2025/11/27 5:17 a.m.24 views

CVE-2025-12123 Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting

The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

6.1CVSS0.00205EPSS
SaveExploits0References2
CVE
CVE
added 2025/11/27 5:17 a.m.32 views

CVE-2025-12123

CVE-2025-12123 concerns the WordPress plugin Customer Reviews Collector for WooCommerce . Multiple sources confirm a reflected Cross-Site Scripting vulnerability in versions up to 4.6.1, caused by insufficient input sanitization and output escaping of the email-text parameter. The impact allows u...

6.1CVSS5.3AI score0.00205EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2025/11/27 12:00 a.m.15 views

PT-2025-48234

The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

6.1CVSS5.6AI score0.00205EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2025/11/25 12:43 a.m.13 views

WordPress Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin <= 14 - Missing Authorization to Unauthenticated Information Disclosure vulnerability

Missing Authorization to Unauthenticated Information Disclosure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin OrderConvo versions = 14...

5.3CVSS6.6AI score0.00284EPSS
SaveExploits0References1Affected Software1
CNVD
CNVD
added 2025/11/25 12:00 a.m.17 views

WordPress ELEX WordPress HelpDesk&Customer Ticketing System plugin missing privilege check vulnerability

WordPress ELEX WordPress HelpDesk& Customer Ticketing System plugin is a helpdesk and customer work order system plugin designed for WordPress websites, designed to help businesses or individuals efficiently manage customer support requests. WordPress ELEX WordPress HelpDesk& Customer Ticketing...

4.3CVSS6.8AI score0.00188EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2025/11/25 12:00 a.m.13 views

PT-2025-48011

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get order by id function in all versions up to, and including, 14. This makes it possible for unauthenticated attacker...

5.3CVSS5.4AI score0.00284EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2025/11/24 9:27 a.m.23 views

CVE-2025-13544

A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /customerregister.php. Executing manipulation can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has bee...

9.8CVSS6.5AI score0.00377EPSS
SaveExploits1References1
CNVD
CNVD
added 2025/11/24 12:00 a.m.11 views

Complete Online Beauty Parlor Management System /customer-list.php file cross-site scripting vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. Complete Online Beauty Parlor Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Name ...

6.1CVSS6AI score0.00248EPSS
SaveExploits1References1
NVD
NVD
added 2025/11/23 9:15 a.m.14 views

CVE-2025-13544

A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /customerregister.php. Executing manipulation can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has bee...

9.8CVSS0.00377EPSS
SaveExploits1References4
Cvelist
Cvelist
added 2025/11/23 9:02 a.m.29 views

CVE-2025-13544 ashraf-kabir travel-agency customer_register.php unrestricted upload

A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /customerregister.php. Executing manipulation can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has bee...

6.5CVSS0.00377EPSS
SaveExploits1References4
CVE
CVE
added 2025/11/23 9:02 a.m.30 views

CVE-2025-13544

CVE-2025-13544 affects ashraf-kabir travel-agency. The issue is an unrestricted upload vulnerability in an unknown function of /customer_register.php, enabling remote manipulation. The exploit is reported publicly, and the vendor/affected versions are not clearly specified due to rolling releases...

9.8CVSS6.3AI score0.00377EPSS
SaveExploits1References4Affected Software1
CNNVD
CNNVD
added 2025/11/23 12:00 a.m.25 views

Travel Agency 代码问题漏洞

Travel Agency is a travel management website by Ashraf Kabir, an individual developer. Travel Agency has a code issue vulnerability that stems from the presence of unknown functionality in the file /customerregister.php, which could lead to unlimited uploads...

9.8CVSS6.5AI score0.00377EPSS
SaveExploits1References5
Rows per page
Query Builder